I\'m now using password stretching for all user account passwords throughout all my websites. In the db I store an iteration count and randomly assigned salt along with the
Isn't the big benefit of password stretching, that the calculations are done on the client side and therefore they should not affect your server while still providing a good protection?
Frankly, if you implemented it on your server, you are doing it wrong and missed the point :-)